From a446c4db957492b759c1b8e9ffa384efa3fdf7ee Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Thu, 7 Sep 2017 18:49:35 -0400 Subject: gpg: Default to SHA-512 for all signature types on RSA keys. * g10/main.h (DEFAULT_DIGEST_ALGO): Use SHA512 instead of SHA256 in --gnupg mode (leave strict RFC and PGP modes alone). * configure.ac: Do not allow disabling sha512. * g10/misc.c (map_md_openpgp_to_gcry): Always support SHA512. -- SHA512 is more performant on most 64-bit platforms than SHA256, and offers a better security margin. It is also widely implemented. Signed-off-by: Daniel Kahn Gillmor Gbp-Pq: Topic update-defaults Gbp-Pq: Name gpg-Default-to-SHA-512-for-all-signature-types-on-RS.patch --- g10/main.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'g10/main.h') diff --git a/g10/main.h b/g10/main.h index 578a9cb9e..e0fd51856 100644 --- a/g10/main.h +++ b/g10/main.h @@ -41,7 +41,7 @@ # define DEFAULT_CIPHER_ALGO CIPHER_ALGO_3DES #endif -#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA256:DIGEST_ALGO_SHA1) +#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA512:DIGEST_ALGO_SHA1) #define DEFAULT_S2K_DIGEST_ALGO DIGEST_ALGO_SHA1 #ifdef HAVE_ZIP # define DEFAULT_COMPRESS_ALGO COMPRESS_ALGO_ZIP -- cgit v1.2.3